Security Know Now

 Don't steal my bandwidth.....   Don't try to login on my dummy WiFi SSID.   I could have sent them to one of those sites known to steal credentials, or create those little annoying notification pop-ups saying that your computer is infected, and that you need to click on a link to be safe but that's actually the malware.  We call everything around this little toy in the Firewall... "LessonsLearned"

Another super quick post. I quicky built this device: It is a little Raspberry Pi Zero 2 W with a PoE Hat.   Basically, it is a little computer that is powered by Ethernet.  This could be quickly dropped onto an open port of a network and it is an access point with an SSID of Free_WiFi: Seems harmless enough, but it also looks like it hosts a captive portal but this one is just a web server: This portal that I made was harmless but could be used to ask for your point reward card information, or credentials to something like your car's remote app.  Once you enter your credentials it forwards you to the internet where it could be installing malware on your computer, tracing everything that you do and reporting it.  All while you are browsing.  It would make sense so you enter those credentials and then I could get free coffee, change the account password, or get a new remote for your vehicle. This little drop box can also be used to allow remote access to you...

 People make fun of me for never using "Free WiFi" I built this super hacky thing in about 15 minutes.  If I was serious, imagine what it would look like. Here's why I won't log into free public WiFi: You go to your local coffee shop and someone sets up a rogue access point like this: You scan for the free wifi and you get an SSID name <favourite coffee shop_WiFi>, and you connect. Nothing our of the ordinary, you get sent to a captive portal to login: Go Ahead, fill in those credentials on that captive portal that sounds and looks legit-ish.  Just use those credentials on your account... maybe you get free points. And they get reported back to the Rogue_Access_Point:

One day,  you are just auditing the firewall logs, just to see how the web filtering is working, and you find this:   What is this?  Am I being too strict with the firewall? Go to Talos. What does it say about marvin-occentus.net? Verdict: unfavorable.   False Positive? Lets quickly google the domain: What does the report say?  What does it do?  Tries to trick you into fake "Google updates" Lets see what Shodan has to say?  Multiple vulnerabilities... In the google search there was a marvin.occentus.net....   What does Talos have to say about that? And for further verification, after an "nslookup" on marvin.occentus.net we take the IP to Shodan? Loks respectable.... Who is Occentus? Looks like an IT company out of Spain.  Typosquatting in the wild.

 Please do not just scan QR codes.     That is how you ended up on this site.   This could have very easily been a site to harvest data from you. Only trusted sources...   How was this successful?   It used a QR code that created a sense of legitimacy, and it used the lack of resources to sell you on the idea that you could save a buck...